feat: Add GitHub Attestation, prepare for signed releases #829
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Static analysis | |
| on: [push, pull_request] | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| analyze-static: | |
| name: Analyze Static Code | |
| runs-on: ubuntu-latest | |
| container: | |
| image: ghcr.io/microsoft/kompli/ubuntu-22.04-amd64@sha256:006b8545d00520c1cfc83f0ac465d7aedeb876a32435c57bbe3dc94c23fdc465 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| with: | |
| submodules: recursive | |
| clean: true | |
| - name: Prepare compile command database | |
| run: | | |
| mkdir -p build | |
| cd build | |
| cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DCMAKE_BUILD_TYPE=Debug ../src | |
| - name: "Temporary: install clang-tools" | |
| run: | | |
| apt-get update | |
| apt-get install -y clang-tools | |
| - name: Run clang static analyzer | |
| run: | | |
| mkdir -p output | |
| analyze-build-14 --verbose \ | |
| --status-bugs \ | |
| --exclude src/common/parson \ | |
| --cdb build/compile_commands.json \ | |
| --output output/scan-build | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| if: success() || failure() | |
| with: | |
| name: scan-build | |
| path: | | |
| output/scan-build |